From f34d46d9f6ffeef58f4c06d09e2ab2f3d42c5b2c Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 31 Oct 2026 15:56:54 +0100 Subject: [PATCH] Define concrete client offboarding scope and retained data boundaries Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3 --- WORK-RECORDS.md | 2 +- .../client-data-export-review-2026-10-30.md | 16 ++ .../client-offboarding-scope-2026-10-31.json | 157 ++++++++++++++++++ ...ent-offboarding-scope-review-2026-10-31.md | 81 +++++++++ .../release/goal-progress-audit-2026-10-31.md | 12 ++ ...0012-durable-recovery-service-readiness.md | 19 ++- 6 files changed, 285 insertions(+), 2 deletions(-) create mode 100644 docs/release/client-offboarding-scope-2026-10-31.json create mode 100644 docs/release/client-offboarding-scope-review-2026-10-31.md diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 723a37f..920a5bb 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -97,7 +97,7 @@ | task | CSOC-WP-0012-T09 | todo | — | workplans/CSOC-WP-0012-durable-recovery-service-readiness.md | | task | CSOC-WP-0012-T10 | todo | — | workplans/CSOC-WP-0012-durable-recovery-service-readiness.md | | task | CSOC-WP-0012-T11 | progress | — | workplans/CSOC-WP-0012-durable-recovery-service-readiness.md | -| task | CSOC-WP-0012-T12 | todo | — | workplans/CSOC-WP-0012-durable-recovery-service-readiness.md | +| task | CSOC-WP-0012-T12 | progress | — | workplans/CSOC-WP-0012-durable-recovery-service-readiness.md | | task | CSOC-WP-0012-T13 | done | — | workplans/CSOC-WP-0012-durable-recovery-service-readiness.md | | task | CSOC-WP-0012-T14 | done | — | workplans/CSOC-WP-0012-durable-recovery-service-readiness.md | | task | CSOC-WP-0013-T01 | done | — | workplans/CSOC-WP-0013-sharing-content-hardening.md | diff --git a/docs/release/client-data-export-review-2026-10-30.md b/docs/release/client-data-export-review-2026-10-30.md index 45b8f5c..ea360fd 100644 --- a/docs/release/client-data-export-review-2026-10-30.md +++ b/docs/release/client-data-export-review-2026-10-30.md @@ -96,3 +96,19 @@ session revocation, process-log disposition and primary/mirror/protected-kit bac expiry. The existing independent-kit no-expiry protection must not be silently overridden. No client offboarding or productive deletion is authorized by this implementation or its tests. + +## October31 deployed return and offboarding scope + +Revision19 has since deployed the reviewed exporter. Its packaged current-point +proof verifies85selected local files and four record sets, no selected external +bindings and unchanged source data; the temporary ZIP was removed afterward. +See `identity-export-release-client-export-2026-10-31.json`. The earlier source-only +and81file statements above retain their original dated scope. + +The subsequent native scope check finds a second space outside the accepted +export tenant, with an external binding under the deployment default tenant. +Zero external bindings in the selected tenant must not be promoted to complete +instance attribution. The retained content PVC, five isolated database restores, +sessions, root journals and protected backup holds also need explicit disposition. +T12's concrete review is `client-offboarding-scope-review-2026-10-31.md`; it does +not authorize teardown or deletion of this active service. diff --git a/docs/release/client-offboarding-scope-2026-10-31.json b/docs/release/client-offboarding-scope-2026-10-31.json new file mode 100644 index 0000000..6237a65 --- /dev/null +++ b/docs/release/client-offboarding-scope-2026-10-31.json @@ -0,0 +1,157 @@ +{ + "schema": "coulomb.client-offboarding-scope.v1", + "recorded_at": "2026-10-31T14:55:21.318848+00:00", + "task": "CSOC-WP-0012-T12", + "task_status": "progress", + "current_application_scope": { + "observed_at": "2026-10-31T14:51:29.215499+00:00", + "scope": "accepted tenant:platform only; canonical client binding unresolved", + "database_name": "coulomb_social_db", + "record_counts": { + "members.user": 1, + "members.member": 1, + "spaces.space": 1, + "spaces.spacemembership": 1 + }, + "selected_local_content_files": 85, + "external_binding_count": 0, + "all_spaces_count": 2, + "selected_spaces_count": 1, + "session_row_count": 43, + "export_ownership_checks_passed": true, + "read_only_repeatable_read_transaction": true, + "external_writer_fence": false, + "coherent_export_created": false, + "source_changed": false + }, + "unselected_scope": { + "unselected_spaces": 1, + "unselected_external_bindings": 1, + "unselected_tenant_count": 1, + "unselected_tenants_match_deployment_default": true, + "unselected_spaces_with_creator": 0, + "canonical_client_assignment_inferred": false + }, + "native_content_storage": { + "observed_at": "2026-10-31T14:49:42.586579+00:00", + "deployment_uid": "2dbe661a-d232-4477-bbd1-833813077fbe", + "persistent_claims": [ + { + "name": "coulomb-social-content", + "uid": "9888abeb-9d52-4c70-a23d-b5494780d9c3", + "phase": "Bound", + "storage_class": "local-path", + "capacity": { + "storage": "2Gi" + }, + "helm_resource_policy": "keep", + "pv_name": "pvc-9888abeb-9d52-4c70-a23d-b5494780d9c3", + "pv_uid": "ac1aa73c-08d9-4561-995b-41060468e506", + "pv_reclaim_policy": "Delete", + "claim_uid_matches": true + } + ], + "configuration_changed": false + }, + "retained_local_restores": { + "containers": 5, + "running": 5, + "backing_database_volumes": 5, + "all_networks_internal": true, + "all_networks_single_container": true, + "published_ports": 0, + "public_receipt_linked_containers": 4, + "additional_private_receipt_sha256": "cc1d1be94da22756b52a00cc743ecd72b5cf8e956a7fd91288174dbb4499902b", + "additional_public_binding": "docs/release/identity-export-release-client-export-2026-10-31.json", + "all_five_have_receipt_bindings": true, + "stopped_or_deleted": false + }, + "scope_limits": { + "canonical_client_assignment_resolved": false, + "unselected_external_content_resolved": false, + "fresh_coherent_export_created": false, + "client_delivery_or_acceptance": false, + "sessions_decoded_or_revoked": false, + "instance_or_data_deleted": false, + "backup_hold_released": false, + "provider_expiry_performed": false, + "disposable_offboarding_rehearsal_performed": false, + "offboarding_accepted": false + }, + "private_inventory_files": [ + { + "name": "accepted-point-link.json", + "sha256": "eb54af2fe49bf90a02680d68c8f69335e8a591042479faa0367dc9c925f6f097" + }, + { + "name": "current-application-scope.json", + "sha256": "e24c3112c52e8ffd80a146c4dec8bd00e187ca0de14661644dd58206ebc535a6" + }, + { + "name": "native-storage.json", + "sha256": "e8f4c32462ffb9869ceaf8991874d14858705ebe59978eb9fc2743daa0135efc" + }, + { + "name": "restore-scope-linked.json", + "sha256": "8f2af25c9c80c69319bd6b61cf96094fe4054ed27fc1c63ae586962987971111" + }, + { + "name": "restore-scope-summary.json", + "sha256": "6d24beb8739c34eaa6c34b9d5829b161ba5e863eea1376103598b7a2f04822a5" + }, + { + "name": "retained-restores.json", + "sha256": "5b24822d8025c83011a286f097ca7f88125e42979864660ec5613e5b83a1323d" + }, + { + "name": "unselected-scope.json", + "sha256": "33df8b171bfc31713118b216f1fb3b113c716d42560a00585eaee0fa91dcd56d" + } + ], + "evidence_sources": [ + { + "path": "docs/release/identity-export-release-client-export-2026-10-31.json", + "sha256": "d1b9d88b850a5aed19159bee867c4b0723a7a1df9e13c179d57a3de9e9cb67af" + }, + { + "path": "docs/release/provider-kit-recovery-post-date-2026-10-31.json", + "sha256": "b7191972f4e4f7d0b74ae7bbdeb93aabdb79e2baf27ccb49108f6f30f417182c" + }, + { + "path": "docs/release/generation-retention-post-date-2026-10-31.json", + "sha256": "10c78d8a69c02f28f9ad5f126c4daac89f6988516e3234ea67eaee6c0b5be6df" + }, + { + "path": "coulomb_social/apps/members/client_export.py", + "sha256": "223a9ee42af6f17829aa263abcae595626e292b887de85820f48fdfa4a6363fa" + }, + { + "path": "/home/worsch/railiance-apps/helm/coulomb-social-values.yaml", + "sha256": "63a45d1cfb395eff7cfdf21ed2100fb9562b7a2ab6b896afecbebfaabacae547" + }, + { + "path": "/home/worsch/railiance-apps/charts/coulomb-social/templates/content-pvc.yaml", + "sha256": "5c4ddcaee2b3dcdf17da061b1a7a2cb1e0398d2f56f4ef31790cfaaf648b0fee" + }, + { + "path": "/home/worsch/the-custodian/canon/standards/business-app-service-contract_v0.1.md", + "sha256": "83d2799d39f957d88aa1d71c3f04f7c2a0e168390249dc409ce149128d44e80c" + } + ], + "statehub_readback": { + "task_id": "54af74b0-3212-537e-a02c-d2d8a091caf9", + "status": "progress", + "scope_review_synced": true, + "fix_consistency_exit_code": 0, + "automation_errors": 0, + "assessment_failures": 0, + "warnings": 8 + }, + "validation": { + "native_scope_assertions_passed": true, + "private_modes_and_hashes_verified": true, + "source_hashes_verified": true, + "json_round_trip_checked": true, + "application_code_changed": false + } +} diff --git a/docs/release/client-offboarding-scope-review-2026-10-31.md b/docs/release/client-offboarding-scope-review-2026-10-31.md new file mode 100644 index 0000000..09d6af9 --- /dev/null +++ b/docs/release/client-offboarding-scope-review-2026-10-31.md @@ -0,0 +1,81 @@ +# Client offboarding scope review — 2026-10-31 + +CSOC-WP-0012-T12 now has a concrete, non-destructive scope review. It remains +**progress**, not accepted or executable. This review neither closes the active +service nor authorizes deletion, session revocation, expiry or credential changes. + +The governing [service contract §6.2](/home/worsch/the-custodian/canon/standards/business-app-service-contract_v0.1.md) +requires support for complete client export and deletion: export, instance +teardown and backup expiry. Demonstrating that capability does not require +tearing down this active client now. T12 still needs its agreed scope, private +export delivery/acceptance and independently verified teardown/expiry procedure. + +## Verified scope and unresolved attribution + +The packaged revision19 export proof covers the accepted `tenant:platform`: +one User, Member, Space and SpaceMembership and85local files. Its coherent +07:13recovery point had no external bindings in that selected tenant. The temporary +export was removed after validation; this is not a delivered client archive. + +A fresh read-only application transaction at14:51Z repeats the ownership checks +and finds the same four record counts and85selected local files, with no selected +external binding. It also finds **two spaces in the instance**, one outside the +selected tenant. A separate bounded read confirms that unselected space has an +external binding and belongs to the configured default tenant (`tenant:coulomb`), +with no creator link. These facts do not establish its legal client, whether it +is dispensable, or whether its remote content has been preserved. T11's canonical +client/app/instance mapping and the disposition of this unselected binding must +precede any proposal to tear down the whole database or instance. + +The live read observed43session rows. Those rows were counted, not decoded or +attributed to the selected client. The read used a read-only transaction; app +writers were not fenced and no new coherent export was created. Do not combine +its counts with the older export hash to claim a newly verified deliverable. + +## Stores and owner returns + +| Store or boundary | Established evidence | Required offboarding return | +| --- | --- | --- | +| App SQL data, local principals, grants and admin history | Database `coulomb_social_db`; schema-derived inventory and selected-tenant export guards; one unselected externally bound space | Resolve client/tenant scope, produce and privately deliver a final coherent export, obtain acceptance, then review the database/role action through the deployment/database owners. Preserve the shared apps-pg cluster and other databases. | +| Local pages, assets, aliases and all revisions |85selected local files; deployed content PVC `coulomb-social-content`, UID9888abeb-9d52-4c70-a23d-b5494780d9c3, Bound2Gi/local-path | Export all assigned content, including deleted-page revisions. A future teardown must separately identify the claim/PV and verify its storage outcome. The PVC has `helm.sh/resource-policy: keep`; uninstalling the release alone is not content deletion. | +| App sessions and transient OIDC state |43current session rows; intentionally excluded from the client ZIP | Establish the approved app/tenant scope and revoke its sessions through a reviewed action. A count does not attribute anonymous/transient sessions; do not infer authority to revoke shared identity-provider sessions. | +| External content and identity links | One unselected externally bound space; OIDC/NetKingdom and user-engine are shared owners | Resolve the remote content and client assignment. Review only application-specific links/grants with their owners; do not delete shared human identities, provider clients or services based on local Member removal. | +| Node backup and release state | Existing paired archives, release capsules and date-operation journals; date journals can retain original index bytes outside CONTENT_ROOT | Include all assigned private bytes and journal/preimage copies in the exact retained/deleted set. T04's custody repair changes ownership/modes only and is not a disposition or expiry approval. | +| Local retained restores | Five running PostgreSQL recovery containers, five volume-backed stores; internal networks, one container each, no published ports | Preserve them pending disposition. The private inventory records container IDs, volume/mount identities, networks and links to existing restore receipts. Future cleanup must bind exact identities and verify both database volumes and corresponding plaintext content directories; stopping a container is not deletion. | +| Private source captures, review bundles and local archives | Source inventory spans71spaces and several source principals; private review/export copies are outside the live app | Classify ownership before deleting any directory. The whole source capture is not automatically the selected tenant's dataset. Preserve originals, accepted evidence and unresolved source records until explicit disposition. | +| Primary provider copies | Dedicated Coulomb application-archive prefix in shared `railiance-platform-pg-backup` | Provider owner must inventory exact versions, retain the final accepted export/recovery point as agreed, then execute admitted expiry. Do not delete the shared bucket or other applications' prefixes. | +| Mirrored generations and public receipts | Existing dated generation selection and exact-version readback; expiry remains separately admitted | Recompute the current exact keep/expiry set at execution. Rolling retention is not full client offboarding; deleting one mirror does not remove primary or protected copies. | +| Protected kits, proofs and separate recovery-key custody | Latest provider kit4166eb8b/version1793432303941465 is explicitly outside automatic expiry | Obtain explicit owner disposition for all client-bearing kit versions, proofs and associated recovery custody. Existing no-expiry protection remains in force; destroying a key alone is not a demonstrated complete offboarding procedure. | +| Logs, telemetry and notification ledgers | App/process logs and operator state are outside the ZIP; email-connect is a shared owner | Establish attribution and the permitted retention/expiry outcome with each owner. No log, mail-ledger or telemetry payload inventory or removal is claimed here. Preserve unrelated applications and required retained records. | +| Deployment, endpoint and credential projections | Revision19 and its declared resource/identity boundaries remain active | After accepted export and explicit teardown admission, remove only the bound instance resources/projections and verify routing, workloads, data stores and owner returns. Keep shared cluster, forge, identity, mail, telemetry and provider services. | + +The PVC's native PV reclaim policy is `Delete`, and its claim UID matches the +bound PVC. That policy is a configuration fact, not proof of deletion: the claim +has not been removed, and no storage teardown has been exercised. + +## Evidence and closure sequence + +The public aggregate proof is `client-offboarding-scope-2026-10-31.json`. Exact +local restore volume/path metadata stays in the private +`~/.config/coulomb-social/auth/exports/offboarding-review-20261031/` inventory. +Four restore containers link directly to public recovery receipts; the fifth +links through the private receipt whose SHA matches the published revision19 +client-export proof. All five remain running and untouched. + +1. Bind the canonical client to the actual tenant/instance scope and resolve the + unselected external binding; do not substitute the deployment default tenant. +2. Agree the complete store list and retention/expiry outcomes, including the + protected-kit hold, shared-owner stores and retained private copies. +3. Prepare the exact teardown/expiry procedure and demonstrate it on a disposable + scoped instance and provider-owner test resources. Keep production identities, + data and held backups out of that destructive rehearsal. +4. Produce a fresh coherent export for private delivery and obtain the required + client acceptance. The existing rehearsal archive no longer exists. +5. If actual offboarding is later requested, bind the then-current identities, + object versions, writer fence, accepted export and approvals before execution; + retain independent completion/exception receipts for every included store. + +This review does not choose retention durations, release holds, infer a client ID +or claim that steps3–5 have been performed. It supplies the missing concrete +scope for T12 while preserving T04 retention, T11 attribution, WP-0013 portability +and WP-0014 source/grant obligations. diff --git a/docs/release/goal-progress-audit-2026-10-31.md b/docs/release/goal-progress-audit-2026-10-31.md index 2aa3ee4..3f812e7 100644 --- a/docs/release/goal-progress-audit-2026-10-31.md +++ b/docs/release/goal-progress-audit-2026-10-31.md @@ -172,3 +172,15 @@ admission does not establish all-space identity or role mappings. The task remai progress: this closes an evidence gap inside the task, not productive permission reconciliation. The checklist stays 14 of 33 done, and the remaining-effort estimate is unchanged. Evidence: `bubble-access-audit-2026-10-31.json`. + +## Offboarding scope checkpoint + +WP-0012-T12 moves from todo to progress with a concrete non-destructive scope +review. Fresh native evidence distinguishes the accepted85file tenant export from +the second, externally bound space; confirms the Helm-retained content PVC; and +accounts for five still-running isolated recovery databases and their receipts. +The review includes sessions, root journals, private copies and protected backup +holds. No teardown, deletion, revocation or expiry occurred. Canonical client +scope, agreed retention, procedure proof and private delivery/acceptance remain +open. The checklist stays14of33done; the effort estimate is unchanged. Evidence: +`client-offboarding-scope-2026-10-31.json` and its human-readable scope review. diff --git a/workplans/CSOC-WP-0012-durable-recovery-service-readiness.md b/workplans/CSOC-WP-0012-durable-recovery-service-readiness.md index 302dbe1..dcbeec4 100644 --- a/workplans/CSOC-WP-0012-durable-recovery-service-readiness.md +++ b/workplans/CSOC-WP-0012-durable-recovery-service-readiness.md @@ -720,13 +720,30 @@ leaving revision18/source-only export as its lead state. T11 remains progress. ```task id: CSOC-WP-0012-T12 -status: todo +status: progress priority: high state_hub_task_id: "54af74b0-3212-537e-a02c-d2d8a091caf9" ``` Remaining T03 service-contract §6: resolve external/unattributed data, obtain private delivery/acceptance of complete client export, and agree instance teardown, sessions, logs and primary/mirror/protected-kit expiry. Current packaged export proof covers 85 selected files and four record sets; it is not offboarding acceptance. Coordinate retention with T04 and personal portability with WP-0013-T03. Record non-destructive review first; do not infer authorization to delete data. +2026-10-31: T12 advances to progress with the concrete non-destructive scope review +in `docs/release/client-offboarding-scope-review-2026-10-31.md`. Fresh read-only +application checks repeat the accepted tenant's four record counts/85local files/ +zero external bindings, but find one other space with an external binding under +the deployment default tenant. The accepted export therefore does not establish +whole-instance client scope. Forty-three session rows remain unattributed by +this count-only check. Native storage metadata confirms the2Gi content PVC is +Helm-retained even though its PV reclaim policy is Delete. Five retained recovery +databases are running on internal networks with no published ports; exact private +volume/path inventory and existing receipt bindings are retained. None was stopped +or deleted. The review maps SQL/content, sessions, external/shared owners, node +journals, local copies and primary/mirror/protected stores to their required +returns. §6.2 requires an offboarding capability, not destruction of this active +service as a completion shortcut. Scope/retention agreement, disposable procedure +proof and private export delivery/acceptance remain open. Aggregate evidence: +`docs/release/client-offboarding-scope-2026-10-31.json`. + ## Completion Finish when every task above has its stated evidence and acceptance, or hand off any newly discovered residual to a live work record first. Cross-owner dependencies remain their existing canonical records.